Repository navigation
Conversation
dnt runs \`npm install\` in npm/ which resolves the latest transitive dependency versions, ignoring deno.lock. Whenever a transitive dependency (e.g. json-with-bigint) releases a new version, dist/main.js drifts and the CI's assert_unchanged check fails even though deno.lock is unchanged. Preserve npm/package-lock.json across builds and track it in git so that npm install installs the same pinned versions every time.
There was a problem hiding this comment.
Pull request overview
This PR updates the repo’s CI/dependency-update tooling to better support Deno dependencies and to make the generated JS bundle reproducible by pinning npm transitive dependencies used during the Deno-to-npm build.
Changes:
- Add Dependabot version updates for the Deno ecosystem.
- Make
dist/main.jsreproducible by preserving a committednpm/package-lock.jsonacrossdntbuilds. - Change the auto-update workflow schedule from monthly to quarterly.
Reviewed changes
Copilot reviewed 3 out of 6 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
scripts/bundle.ts |
Preserves/restores npm/package-lock.json across ./npm clean/build to stabilize dnt’s npm install resolution. |
npm/package-lock.json |
Adds a committed npm lockfile to pin the full transitive dependency tree used by bundling. |
dist/main.js |
Regenerated bundle output consistent with the pinned lockfile. |
.gitignore |
Keeps npm/ build artifacts ignored while allowing npm/package-lock.json to be tracked. |
.github/workflows/auto-update.yml |
Adjusts the scheduled auto-update cadence to quarterly. |
.github/dependabot.yml |
Enables Dependabot updates for the Deno ecosystem (grouped). |
Files not reviewed (1)
- npm/package-lock.json: Generated file
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
- Only swallow NotFound when restoring package-lock.json; rethrow other errors - Regenerate npm/package-lock.json against the official npm registry so CI no longer depends on the npmmirror mirror
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 3 out of 6 changed files in this pull request and generated no new comments.
Files not reviewed (1)
- npm/package-lock.json: Generated file
Suppressed comments (1)
npm/package-lock.json:25
- PR description Notes section says the committed package-lock.json contains resolved URLs pointing to
registry.npmmirror.com, but this lockfile appears to useregistry.npmjs.org(e.g. theresolvedURL here). Consider updating the PR description (or regenerating the lockfile with the intended registry) to avoid misleading future maintainers about where CI will download packages from.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Overview
Three CI-related changes:
dist/main.jsnon-reproducibility that caused CI failuresBackground
CI fails on dependency updates even though
deno.lockis present. Root cause:deno.lockonly pins the dependencies Deno resolves (jsr:/npm:import chains), while thenpm installrun internally by dnt inscripts/bundle.tsresolves the latest transitive dependency versions from the npm registry (e.g.json-with-bigint). Whenever such a transitive dependency releases a new version,dist/main.jsdrifts and the CIassert_unchangedcheck fails.Changes
.github/dependabot.ymldenopackage ecosystem (directory/, monthly, grouped into a single PR)scripts/bundle.tsnpm/package-lock.jsonacross builds sonpm installinstalls pinned versions; only swallowNotFounderrors when restoring the lockfile.gitignorenpm/package-lock.jsonin version controlnpm/package-lock.jsonjson-with-bigint@3.5.11), resolved via the official npm registrydist/main.js.github/workflows/auto-update.yml0 0 1 * *to quarterly0 0 1 */3 *Verification
just cipasses locally (working tree clean after build)dist/main.jsno longer drifts when npm transitive dependencies are releaseddeno update+just dev+just bundle): no diff producedpackage-lock.json+dist/main.js) by auto-updateNotes
package-lock.jsonuses the official npm registry (registry.npmjs.org) for allresolvedURLs